From 792c86887e929573e9ba057f18661a86ed3e2001 Mon Sep 17 00:00:00 2001
From: David Malcolm <dmalcolm@redhat.com>
Date: Tue, 5 Mar 2019 12:54:49 -0500
Subject: [PATCH 52/87] FIXME: emit warnings rather than errors

---
 gcc/analyzer/engine.cc                            | 10 ++---
 gcc/analyzer/hardcoded-state-machine.cc           | 52 +++++++++++++----------
 gcc/analyzer/hardcoded-state-machine.h            |  8 ++--
 gcc/testsuite/gcc.dg/analyzer/file-1.c            |  6 +--
 gcc/testsuite/gcc.dg/analyzer/malloc-1.c          | 32 +++++++-------
 gcc/testsuite/gcc.dg/analyzer/malloc-dce.c        |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c      |  4 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c      |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c      |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c      |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c      |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-many-paths.c |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c    |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c    |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c    |  2 +-
 gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c    |  2 +-
 gcc/testsuite/gcc.dg/analyzer/taint-1.c           |  2 +-
 17 files changed, 70 insertions(+), 64 deletions(-)

diff --git a/gcc/analyzer/engine.cc b/gcc/analyzer/engine.cc
index 7298a7e..cefbaef 100644
--- a/gcc/analyzer/engine.cc
+++ b/gcc/analyzer/engine.cc
@@ -628,10 +628,10 @@ public:
 		     m_sm_inst->m_active_vars.to_str (m_engine->m_sm).c_str ());
   }
 
-  void error (const supernode *node, const gimple *stmt,
-	      tree var, state_machine::state_t state,
-	      const metadata *m,
-	      const char *fmt, ...) FINAL OVERRIDE
+  void warn_for_state (const supernode *node, const gimple *stmt,
+		       tree var, state_machine::state_t state,
+		       const metadata *m,
+		       const char *fmt, ...) FINAL OVERRIDE
   {
     JIT_LOG_FUNC (m_engine->get_logger ());
 
@@ -653,7 +653,7 @@ public:
 	push_cfun (node->m_fun);
 	va_list ap;
 	va_start (ap, fmt);
-	emit_diagnostic_valist (DK_ERROR, &rich_loc, m, 0, fmt,
+	emit_diagnostic_valist (DK_WARNING, &rich_loc, m, 0, fmt,
 				&ap);
 	va_end (ap);
 	pop_cfun ();
diff --git a/gcc/analyzer/hardcoded-state-machine.cc b/gcc/analyzer/hardcoded-state-machine.cc
index 1b81e07..a9d977c 100644
--- a/gcc/analyzer/hardcoded-state-machine.cc
+++ b/gcc/analyzer/hardcoded-state-machine.cc
@@ -159,11 +159,11 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
 	  /* Keep state "null" as-is, rather than transitioning to "free";
 	     we don't want want to complain about double-free of NULL.  */
 
-	  /* free -> stop, with error.  */
+	  /* free -> stop, with warning.  */
 	  metadata m;
 	  m.add_cwe (415); /* CWE-415: Double Free.  */
-	  sm_ctxt->error (node, stmt, arg, m_free, &m,
-			  "double-free of %qE", arg);
+	  sm_ctxt->warn_for_state (node, stmt, arg, m_free, &m,
+				   "double-free of %qE", arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_free, m_stop);
 	}
     }
@@ -201,20 +201,20 @@ malloc_state_machine::on_stmt (sm_context *sm_ctxt,
 	    /* CWE-690: Unchecked Return Value to NULL Pointer Dereference.  */
 	    metadata m;
 	    m.add_cwe (690);
-	    sm_ctxt->error (node, stmt, arg, m_unchecked, &m,
-			    "use of possibly-NULL %qE", arg);
+	    sm_ctxt->warn_for_state (node, stmt, arg, m_unchecked, &m,
+				     "use of possibly-NULL %qE", arg);
 	    sm_ctxt->on_transition (node, stmt, arg, m_unchecked, m_nonnull);
 
-	    sm_ctxt->error (node, stmt, arg, m_null, &m,
-			    "use of NULL %qE", arg);
+	    sm_ctxt->warn_for_state (node, stmt, arg, m_null, &m,
+				     "use of NULL %qE", arg);
 	    sm_ctxt->on_transition (node, stmt, arg, m_null, m_stop);
 	  }
 
 	  {
 	    metadata m;
 	    m.add_cwe (416); /* CWE-416: Use After Free.  */
-	    sm_ctxt->error (node, stmt, arg, m_free, &m,
-			    "use after free of %qE", arg);
+	    sm_ctxt->warn_for_state (node, stmt, arg, m_free, &m,
+				     "use after free of %qE", arg);
 	    sm_ctxt->on_transition (node, stmt, arg, m_free, m_stop);
 	  }
 	}
@@ -273,8 +273,10 @@ malloc_state_machine::on_leak (sm_context *sm_ctxt,
 {
   metadata m;
   m.add_cwe (401);
-  sm_ctxt->error (node, stmt, var, m_unchecked, &m, "leak of %qE", var);
-  sm_ctxt->error (node, stmt, var, m_nonnull, &m, "leak of %qE", var);
+  sm_ctxt->warn_for_state (node, stmt, var, m_unchecked, &m,
+			   "leak of %qE", var);
+  sm_ctxt->warn_for_state (node, stmt, var, m_nonnull, &m,
+			   "leak of %qE", var);
 }
 
 ////////////////////////////////////////////////////////////////////////////
@@ -327,8 +329,8 @@ fileptr_state_machine::on_stmt (sm_context *sm_ctxt,
 
 	  sm_ctxt->on_transition (node, stmt , arg, m_nonnull, m_closed);
 
-          sm_ctxt->error (node, stmt, arg, m_closed, NULL,
-			  "double %<fclose%> of FILE %qE", arg);
+	  sm_ctxt->warn_for_state (node, stmt, arg, m_closed, NULL,
+				   "double %<fclose%> of FILE %qE", arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_closed, m_stop);
 	}
 
@@ -390,10 +392,10 @@ fileptr_state_machine::on_leak (sm_context *sm_ctxt,
 {
   metadata m;
   m.add_cwe (775);
-  sm_ctxt->error (node, stmt, var, m_unchecked, &m,
-		  "leak of FILE %qE", var);
-  sm_ctxt->error (node, stmt, var, m_nonnull, &m,
-		  "leak of FILE %qE", var);
+  sm_ctxt->warn_for_state (node, stmt, var, m_unchecked, &m,
+			   "leak of FILE %qE", var);
+  sm_ctxt->warn_for_state (node, stmt, var, m_nonnull, &m,
+			   "leak of FILE %qE", var);
 }
 
 ////////////////////////////////////////////////////////////////////////////
@@ -459,9 +461,10 @@ taint_state_machine::on_stmt (sm_context *sm_ctxt,
 	  tree arg = TREE_OPERAND (rhs1, 1);
 	  metadata m;
 	  m.add_cwe (129);
-	  sm_ctxt->error (node, stmt, arg, m_tainted, &m,
-			  "use of tainted value %qE in array lookup without bounds checking",
-			  arg);
+	  sm_ctxt->warn_for_state
+	    (node, stmt, arg, m_tainted, &m,
+	     "use of tainted value %qE in array lookup without bounds checking",
+	     arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_tainted, m_stop);
 	}
     }
@@ -482,13 +485,16 @@ taint_state_machine::on_stmt (sm_context *sm_ctxt,
       if (TREE_CODE (op) == MEM_REF)
 	{
 	  tree arg = TREE_OPERAND (op, 0);
-	  sm_ctxt->error (node, stmt, arg, m_unchecked, "use of possibly-NULL %qE", arg);
+	  sm_ctxt->warn_for_state (node, stmt, arg, m_unchecked,
+				   "use of possibly-NULL %qE", arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_unchecked, m_nonnull);
 
-	  sm_ctxt->error (node, stmt, arg, m_null, "use of NULL %qE", arg);
+	  sm_ctxt->warn_for_state (node, stmt, arg, m_null,
+				   "use of NULL %qE", arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_null, m_stop);
 
-	  sm_ctxt->error (node, stmt, arg, m_free, "use after free of %qE", arg);
+	  sm_ctxt->warn_for_state (node, stmt, arg, m_free,
+				   "use after free of %qE", arg);
 	  sm_ctxt->on_transition (node, stmt, arg, m_free, m_stop);
 	}
     }
diff --git a/gcc/analyzer/hardcoded-state-machine.h b/gcc/analyzer/hardcoded-state-machine.h
index df9c36c..39db59c 100644
--- a/gcc/analyzer/hardcoded-state-machine.h
+++ b/gcc/analyzer/hardcoded-state-machine.h
@@ -76,10 +76,10 @@ public:
 
   //virtual state_machine::state_t get_state (tree var) = 0;
   //virtual void transition (tree var, state_machine::state_t to) = 0;
-  virtual void error (const supernode *node, const gimple *stmt,
-		      tree var, state_machine::state_t state,
-		      const metadata *m,
-		      const char *fmt, ...) = 0;
+  virtual void warn_for_state (const supernode *node, const gimple *stmt,
+			       tree var, state_machine::state_t state,
+			       const metadata *m,
+			       const char *fmt, ...) = 0;
 
   // etc, what else?
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/file-1.c b/gcc/testsuite/gcc.dg/analyzer/file-1.c
index 86d08e0..af5bcc7 100644
--- a/gcc/testsuite/gcc.dg/analyzer/file-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/file-1.c
@@ -8,7 +8,7 @@ test_1 (const char *path)
     return;
 
   fclose (f);
-  fclose (f); /* { dg-error "double 'fclose' of FILE 'f'" } */ 
+  fclose (f); /* { dg-warning "double 'fclose' of FILE 'f'" } */ 
 }
 
 void
@@ -20,7 +20,7 @@ test_2 (const char *src, const char *dst)
 
   FILE *f_out = fopen (src, "w");
   if (!f_out)
-    return; /* { dg-error "leak of FILE 'f_in'" } */ 
+    return; /* { dg-warning "leak of FILE 'f_in'" } */ 
 
   fclose (f_out);
   fclose (f_in);
@@ -30,5 +30,5 @@ void
 test_3 (const char *path)
 {
   FILE *f = fopen (path, "r");
-  return; /* { dg-error "leak of FILE 'f'" } */ 
+  return; /* { dg-warning "leak of FILE 'f'" } */ 
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
index 3df72c5..78a8fa1 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-1.c
@@ -8,19 +8,19 @@ void test_1 (void)
 {
   void *ptr = malloc (1024);
   free (ptr);
-  free (ptr); /* { dg-error "double-free of 'ptr'" } */
+  free (ptr); /* { dg-warning "double-free of 'ptr'" } */
 }
 
 void test_2 (void *ptr)
 {
   free (ptr);
-  free (ptr); /* { dg-error "double-free of 'ptr'" } */
+  free (ptr); /* { dg-warning "double-free of 'ptr'" } */
 }
 
 int *test_3 (void)
 {
   int *ptr = (int *)malloc (sizeof (int));
-  *ptr = 42; /* { dg-error "use of possibly-NULL 'ptr'" } */
+  *ptr = 42; /* { dg-warning "use of possibly-NULL 'ptr'" } */
   return ptr;
 }
 
@@ -30,14 +30,14 @@ int *test_4 (void)
   if (ptr)
     *ptr = 42;
   else
-    *ptr = 43; /* { dg-error "use of NULL 'ptr'" } */
+    *ptr = 43; /* { dg-warning "use of NULL 'ptr'" } */
   return ptr;
 }
 
 int test_5 (int *ptr)
 {
   free (ptr);
-  return *ptr; /* { dg-error "use after free of 'ptr'" } */
+  return *ptr; /* { dg-warning "use after free of 'ptr'" } */
 }
 
 void test_6 (void *ptr)
@@ -45,7 +45,7 @@ void test_6 (void *ptr)
   void *q;
   q = ptr;
   free (ptr);
-  free (q); /* { dg-error "double-free of 'q'" } */
+  free (q); /* { dg-warning "double-free of 'q'" } */
   /* The above case requires us to handle equivalence classes in
      state transitions.  */
 }
@@ -76,7 +76,7 @@ void test_9 (void)
 
   int i;
   for (i = 0; i < 1024; i++)
-    free (ptr); /* { dg-error "double-free of 'ptr'" } */
+    free (ptr); /* { dg-warning "double-free of 'ptr'" } */
 }
 
 void test_10 (void)
@@ -88,7 +88,7 @@ void test_10 (void)
     foo ();
 
   free (ptr);
-  free (ptr); /* { dg-error "double-free of 'ptr'" "" { xfail *-*-* } } */ 
+  free (ptr); /* { dg-warning "double-free of 'ptr'" "" { xfail *-*-* } } */ 
   /* TODO(xfail): it's stopping after the 1st time through the loop,
      with a cache hit, and thus not seeing the end of the function.  */
 }
@@ -101,7 +101,7 @@ void test_11 (void)
     bar ();
 
   free (ptr);
-  free (ptr); /* { dg-error "double-free of 'ptr'" } */
+  free (ptr); /* { dg-warning "double-free of 'ptr'" } */
 }
 
 void test_12 (void)
@@ -111,7 +111,7 @@ void test_12 (void)
   while (1)
     {
       free (ptr);
-      free (ptr); /* { dg-error "double-free of 'ptr'" } */
+      free (ptr); /* { dg-warning "double-free of 'ptr'" } */
     }
 }
 
@@ -124,7 +124,7 @@ void test_13 (void)
   if (!q)
     {
       free (q);
-      return; /* { dg-error "leak of 'p'" } */ 
+      return; /* { dg-warning "leak of 'p'" } */ 
     }
   bar ();
   free (q);
@@ -149,7 +149,7 @@ void test_14 (void)
   free (q); /* Although this looks like a double-free of q,
 	       it's known to be NULL for the case where free is
 	       called twice on it.  */
-  free (p); /* { dg-error "double-free of 'p'" } */
+  free (p); /* { dg-warning "double-free of 'p'" } */
 }
 
 void test_15 (void)
@@ -190,7 +190,7 @@ void test_16 (void)
   bar ();
 
  fail:
-  free (q); /* { dg-error "free of uninitialized 'q'" "" { xfail *-*-* } } */ 
+  free (q); /* { dg-warning "free of uninitialized 'q'" "" { xfail *-*-* } } */ 
   /* TODO(xfail): implement uninitialized detection.  */
   free (p);
 }
@@ -198,12 +198,12 @@ void test_16 (void)
 void test_17 (void)
 {
   void *ptr = malloc (1024); 
-} /* { dg-error "leak of 'ptr'" } */ 
+} /* { dg-warning "leak of 'ptr'" } */ 
 
 void test_18 (void)
 {
   void *ptr = malloc (64);
-  ptr = NULL; /* { dg-error "leak of 'ptr'" } */ 
+  ptr = NULL; /* { dg-warning "leak of 'ptr'" } */ 
 }
 
 void test_19 (void)
@@ -239,7 +239,7 @@ void test_22 (void)
     foo ();
 
   free (ptr);
-  free (ptr); /* { dg-error "double-free of 'ptr'" "" { xfail *-*-* } } */ 
+  free (ptr); /* { dg-warning "double-free of 'ptr'" "" { xfail *-*-* } } */ 
   /* TODO(xfail): it's stopping after the 1st time through the loop,
      with a cache hit, and thus not seeing the end of the function.  */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-dce.c b/gcc/testsuite/gcc.dg/analyzer/malloc-dce.c
index ed871c3..67eb515 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-dce.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-dce.c
@@ -6,7 +6,7 @@ void test(void)
 {
     void *ptr = malloc(512);
     free(ptr);
-    free(ptr); /* { dg-error "double-free" "" { xfail *-*-* } } */
+    free(ptr); /* { dg-warning "double-free" "" { xfail *-*-* } } */
 }
 /* FIXME: is this old analysis still correct?
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c
index 01eeb2e..a8009b9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-1.c
@@ -10,7 +10,7 @@ calls_malloc (void)
 int *test_1 (int i)
 {
   int *ptr = (int *)calls_malloc ();
-  *ptr = i; /* { dg-error "use of possibly-NULL 'ptr'" } */
+  *ptr = i; /* { dg-warning "use of possibly-NULL 'ptr'" } */
   return ptr;
 }
 
@@ -19,6 +19,6 @@ int *test_1 (int i)
 int *test_2 (int i)
 {
   int *ptr = (int *)calls_malloc ();
-  *ptr = i; /* { dg-error "use of possibly-NULL 'ptr'" } */
+  *ptr = i; /* { dg-warning "use of possibly-NULL 'ptr'" } */
   return ptr;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c
index 708477a..48d405e 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-2.c
@@ -3,7 +3,7 @@
 void
 calls_free (void *victim)
 {
-  free (victim); /* { dg-error "double-free of 'victim'" } */
+  free (victim); /* { dg-warning "double-free of 'victim'" } */
   /* TODO: this would be better emitted at the callsite,
      for such a simple wrapper.  */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c
index dd7ed34..7d2f9c1 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-3.c
@@ -10,7 +10,7 @@ calls_malloc (void)
 void
 calls_free (void *victim)
 {
-  free (victim); /* { dg-error "double-free of 'victim'" } */
+  free (victim); /* { dg-warning "double-free of 'victim'" } */
   /* TODO: this would be better emitted at the callsite,
      for such a simple wrapper.  */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c
index c3ca150..41a62c1 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-4.c
@@ -9,5 +9,5 @@ void test(void *p)
 {
   calls_free(p);
 
-  free(p); /* { dg-error "double-free of 'p'" } */
+  free(p); /* { dg-warning "double-free of 'p'" } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c
index a2b7548..b70e7cf 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-ipa-5.c
@@ -8,6 +8,6 @@ static int *calls_malloc(void)
 int *test(void)
 {
     int *p = calls_malloc();
-    *p = 42; /* { dg-error "use of possibly-NULL 'p'" } */
+    *p = 42; /* { dg-warning "use of possibly-NULL 'p'" } */
     return p;
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths.c b/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths.c
index 3bb3bd6..062273d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-many-paths.c
@@ -78,6 +78,6 @@ void test_3 (void *ptr)
      within the diamonds.  */
   TEN_DIAMONDS;
 #endif
-  free (ptr); /* { dg-error "double-free of 'ptr'" } */
+  free (ptr); /* { dg-warning "double-free of 'ptr'" } */
 }
 #endif
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c
index 8c746bf..232b2d6 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-1.c
@@ -8,7 +8,7 @@ void test_1 (void)
   free (ptr); /* { dg-line first_free } */
   free (ptr); /* { dg-line second_free } */
 
-  /* { dg-error "double-free of 'ptr'"  "" { target *-*-* } second_free } */
+  /* { dg-warning "double-free of 'ptr'"  "" { target *-*-* } second_free } */
   /* { dg-message "\\(1\\) state of 'ptr': 'start' -> 'unchecked'" "" { target *-*-* } malloc } */
   /* { dg-message "\\(2\\) state of 'ptr': 'unchecked' -> 'free'" "" { target *-*-* } first_free } */
   /* { dg-message "\\(3\\) here \\('ptr' is in state 'free'\\)" "" { target *-*-* } second_free } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c
index 71bada6..e0e40fe 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-2.c
@@ -7,7 +7,7 @@ void test_2 (void *ptr)
   free (ptr); /* { dg-line first_free } */
   free (ptr); /* { dg-line second_free } */
 
-  /* { dg-error "double-free of 'ptr'"  "" { target *-*-* } second_free } */
+  /* { dg-warning "double-free of 'ptr'"  "" { target *-*-* } second_free } */
   /* { dg-message "\\(1\\) state of 'ptr': 'start' -> 'free'" "" { target *-*-* } first_free } */
   /* { dg-message "\\(2\\) here \\('ptr' is in state 'free'\\)" "" { target *-*-* } second_free } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c
index 03e6cb7..2de2ba3 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-3.c
@@ -8,7 +8,7 @@ int *test_3 (void)
   *ptr = 42; /* { dg-line unchecked_deref } */
   return ptr;
 
-  /* { dg-error "use of possibly-NULL 'ptr'" "" { target *-*-* } unchecked_deref } */
+  /* { dg-warning "use of possibly-NULL 'ptr'" "" { target *-*-* } unchecked_deref } */
   /* { dg-message "\\(1\\) state of 'ptr': 'start' -> 'unchecked'" "" { target *-*-* } malloc } */
   /* { dg-message "\\(2\\) here \\('ptr' is in state 'unchecked'\\)" "" { target *-*-* } unchecked_deref } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c
index 6e83d8a..02de853 100644
--- a/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c
+++ b/gcc/testsuite/gcc.dg/analyzer/malloc-paths-4.c
@@ -11,7 +11,7 @@ int *test_4 (void)
     *ptr = 43; /* { dg-line on_null_ptr } */
   return ptr;
 
-  /* { dg-error "use of NULL 'ptr'" "" { target *-*-* } on_null_ptr } */
+  /* { dg-warning "use of NULL 'ptr'" "" { target *-*-* } on_null_ptr } */
   /* { dg-message "\\(1\\) state of 'ptr': 'start' -> 'unchecked'" "" { target *-*-* } malloc } */
   /* { dg-message "\\(2\\) state of 'ptr': 'unchecked' -> 'null'" "" { target *-*-* } cond } */
   /* { dg-message "\\(3\\) here \\('ptr' is in state 'null'\\)" "" { target *-*-* } on_null_ptr } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-1.c b/gcc/testsuite/gcc.dg/analyzer/taint-1.c
index ac315ce..a18a11d 100644
--- a/gcc/testsuite/gcc.dg/analyzer/taint-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/taint-1.c
@@ -15,7 +15,7 @@ char test_1(FILE *f)
   if (1 == fread(&tmp, sizeof(tmp), 1, f)) {
     /* BUG: the following array lookup trusts that the input data's index is
        in the range 0 <= i < 256; otherwise it's accessing the stack */
-    return tmp.buf[tmp.i]; // { dg-error "use of tainted value '<unknown>' in array lookup without bounds checking" }
+    return tmp.buf[tmp.i]; // { dg-warning "use of tainted value '<unknown>' in array lookup without bounds checking" }
     // TODO: better description of value
   }
   return 0;
-- 
1.8.5.3

